基于随机森林的Android恶意软件检测方法研究  

Research on Android Malware Detection Based on Random Forest

作　　者：宋鑫 赵楷[2,3] 张琳琳[2,3] 方文波[4] SONG Xin;ZHAO Kai;ZHANG Linlin;FANG Wenbo(College of Computer,National University of Defense Technology,Changsha Hunan 410073,China;College of Cyber Science and Engineerings Xinjiang University^Urumqi Xinjiang 830046,China;College of Information Science and Engineering,Xinjiang University^Urumqi Xinjiang 830046,China;College of Scfiware,Xinjiang University,Urumqi Xinjiang 830008,China)

机构地区：[1]国防科技大学计算机学院,湖南长沙410073 [2]新疆大学网络空间安全学院,新疆乌鲁木齐830046 [3]新疆大学信息科学与工程学院,新疆乌鲁木齐830046 [4]新疆大学软件学院,新疆乌鲁木齐830008

出　　处：《信息网络安全》2019年第9期1-5,共5页Netinfo Security

基　　金：国家自然科学基金[61867006];新疆维吾尔自治区创新环境(人才、基地)建设专项(自然科学基金)联合基金[2019D01C062];新疆维吾尔自治区高校科研计划[XJEDU2017M005]

摘　　要：文章基于随机森林提出一种Android恶意软件检测方法。以Android的权限作为特征定义了有效权限,利用数据挖掘算法中的支持度和关联规则对权限进行分析,实现有效权限识别。文章构建了随机森林分类器,将有效权限矩阵作为分类器的输入进行训练和测试。实验结果表明,文中方法的检测结果准确率达到92.84%,F值达到93.05%,明显优于其他检测模型。Based on the strong classifier random forest,an Android malware detection method is proposed.With the permission of Android as the feature,the effective permission is defined;the support and association rules in the data mining algorithm are employed to analyze the permission and realize the effective permission identification.Finally,a random forest classifier is constructed,and the effective permission matrix is used as the input of the classifier for training and testing.The experimental results show that the accuracy of the proposed method is 92.84%,and the F-value is 93.05%,which is obviously superior to other detection models.

关 键 词：Android恶意软件检测 有效权限 关联规则 随机森林 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]